First 90 days as SOC Officer

The mistake to avoid

The instinct on arrival is to fix the loudest problem. Resist it for two weeks. The loudest problem is usually a symptom of an unwritten decision made two years ago, and fixing it before you understand that decision buys you a second problem.

The first month is for establishing what is true: what is monitored, what is not, who believes they are covered, and what the last three months of incidents actually looked like. The second month is for writing down what should be true. The third is for getting it approved and measured.

By day 30 — establish the baseline

Turn discovery into numbers. You cannot show improvement from a starting point you never wrote down.

Once

0/9

01Reconcile the log-source inventory against the asset inventory and quantify the gap.
02Measure current detection and response times from whatever timestamps exist — and note where they are unreliable.
03Count alerts per rule for the last 30 days and identify the ten noisiest.
04Establish how many incidents were closed with no documented reason.
05Confirm the retention period actually configured, against the period legally required.
06Verify out-of-hours coverage by testing the contact path, not by reading the rota.
07Map every recurring statutory obligation to a named owner and a calendar entry.
08Write the baseline down and circulate it. An unshared baseline can be renegotiated later.
09Identify the three things that would most embarrass the organisation if a regulator asked today.

By day 60 — write what should be true

Draft the documents. Do not seek approval yet — circulate for objection first.

Once

0/8

01Draft the SOC mandate, or the revision of the existing one, including the out-of-scope column.
02Draft the triage and escalation procedure with written trigger conditions between tiers.
03Draft the severity model, and separately the significant-incident test in operational language.
04Draft the shift handover record format and make it mandatory.
05Define the KPI set you will report, with definitions and measurement methods agreed in advance.
06Draft the monthly report structure and produce one dry-run edition from real data.
07Circulate all drafts to the units they bind — IT operations and system owners — for objection.
08Resolve the objections in writing, so the approval meeting has nothing left to argue about.

By day 90 — get it signed and start the cadence

Convert drafts into approved instruments, and start the rhythm that keeps them alive.

Once

0/8

01Obtain management-body approval of the mandate, including pre-authorised containment.
02Publish the triage procedure and confirm every analyst has read it.
03Issue the first real monthly report against the agreed KPI set.
04Start the weekly tuning review, and clear the ten noisiest rules identified at day 30.
05Schedule the first exercise, and put the quarterly cadence in the calendar for the year.
06Book the annual mandate review now, at the same time as the approval.
07Present the baseline and the 90-day movement to the management body — including what has not improved.
08Name your successor path: who covers you, and what they would need to know.

The question to ask at day 90

If you were replaced tomorrow, could the person who takes over answer a supervisory authority’s questions from documents alone? If the answer depends on you being in the room, the work is not finished — it is just currently working.

First 90 days as SOC Officer

The mistake to avoid

Week 1 — orient, do not act

By day 30 — establish the baseline

By day 60 — write what should be true

By day 90 — get it signed and start the cadence

SOC mandate builder